---
name: "fuzz_ip6"
section: "8"
platform: "linux"
package: "thc-ipv6"
version: "3.8-4"
release: "Arch Linux 2026-11-01"
platforms: ["linux"]
url: "https://new.carta.tech/fuzz_ip6"
---

# fuzz\_ip6(8)

## NAME

**fuzz\_ip6**

## SYNOPSIS

fuzz\_ip6 \[-x\] \[-t number \| -T number\] \[-p number\] \[-IFSDHRJ\] \[-X\|-1\|-2\|-3\|-4\|-5\|-6\|-7\|-8\|-9\|-0 port\|-P type\] interface unicast-or-multicast-address \[address-in-data-pkt\]

Fuzzes an IPv6 packet with optional EHs and upper layer transport

## OPTIONS

```
 -X         do not add any ICMP/TCP header (transport layer)
 -1         fuzz ICMP6 echo request (default)
 -2         fuzz ICMP6 neighbor solicitation
 -3         fuzz ICMP6 neighbor advertisement
 -4         fuzz ICMP6 router advertisement
 -5         fuzz multicast listener report packet
 -6         fuzz multicast listener done packet
 -7         fuzz multicast listener query packet
 -8         fuzz multicast listener v2 report packet
 -9         fuzz multicast listener v2 query packet
 -0         fuzz node query packet
 -s port    fuzz TCP-SYN packet against port
 -P type    fuzz PIMv2 type packet (hello, bootstrap, assert)
 -x         tries all 256 values for flag and byte types
 -t number  continue from test no. number
 -T number  only performs test no. number
 -p number  perform an alive check every number of tests (default: none)
 -a         do not perform initial and final alive test
 -n number  how many times to send each packet (default: 1)
 -I         fuzz the IP header too
 -F         add one-shot fragmentation, and fuzz it too (for 1)
 -S         add source-routing, and fuzz it too (for 1)
 -D         add destination header, and fuzz it too (for 1)
 -H         add hop-by-hop header, and fuzz it too (for 1 and 5-9)
 -R         add router alert header, and fuzz it too (for 5-9 and all)
 -J         add jumbo packet header, and fuzz it too (for 1)
You can only define one of -0 ... -9, -P and -s, defaults to -1.
Note that the -P fuzzing target should be ff02::d
Returns -1 on error, 0 on tests done and targt alive or 1 on target crash.
```

## AUTHOR

thc-ipv6 was written by van Hauser \<vh@thc.org\> / THC

The homepage for this toolkit is: https://github.com/vanhauser-thc/thc-ipv6

## COPYRIGHT

fuzz\_ip6 3.8 (c) 2020 by van Hauser / THC \<vh@thc.org\> www.github.com/vanhauser-thc/thc-ipv6